Traffic analysis on high-speed networks

1. A traffic analyzing system for performing traffic analysis of packets on a communications link connecting a plurality of networks, the system comprising:

a plurality of analyzer circuits connected to each other by a plurality of links, each of which has a data rate lower than a data rate of said communications link; and

wherein the analyzer circuits are configured for performing different levels of analysis on packets travelling along said communications link,

wherein information extracted from the packets analyzed at a first level of analysis by a first analyzer circuit is forwarded to a second level of analysis performed at a second analyzer circuit, the second level comprising at least two analyzers arranged to perform parallel analysis, and wherein the additional analysis performed by the second analyzer circuit depends on the analysis performed by the first analyzer circuit,

wherein the first and second analyzer circuits configured for performing respective different levels of analysis comprise lower and higher level analyzer circuits, respectively,

wherein the lower level analyzer circuit is configured to perform an explicit level of analysis, while the higher level analyzer circuit is configured to perform an implicit level of analysis,

wherein the implicit level of analysis comprises recognizing the presence of a protocol, which is not readily identifiable in a definite manner by a protocol header, which precedes this protocol in a protocol stack, wherein the explicit level of analysis comprises recognizing the presence of a protocol, which is readily identifiable in a definite manner by a protocol header, which precedes this protocol in the protocol stack.

2. The system according to claim 1 , wherein the first and second analyzer circuits configured for performing respective different levels of analysis comprise a common memory for receiving state information provided by the analysis performed by the first and second analyzer circuits.

3. The system according to claim 1 , wherein the explicit level of analysis is configured to recognize protocols for which the packet header sufficiently identifies useful information to formulate a packet signature.

4. The system according to claim 1 , further comprising a network processor aggregating elementary processors; a memory; and a storage module, connected via a communication bus.

5. The system of claim 4 , wherein the network processor comprises a parallel processing architecture.

6. A method for examining network traffic flow by performing analysis of packets on a communications link connecting a plurality of networks, wherein the method comprises:

setting successive levels of analysis within a traffic analyzing system comprising a plurality of analyzer circuits, each of which is configured for performing a different level of analysis at a different layer, wherein a plurality of analyzer circuits are connected to each other by a plurality of links, each of which has a data rate lower than a data rate of said communications link;

forwarding the packets analyzed by the plurality of analyzer circuits, wherein information extracted from the packets analyzed at a first level of analysis by a first analyzer circuit is forwarded to a second level of analysis performed at a second analyzer circuit, the second level comprising at least two analyzers arranged to perform parallel analysis, and so forth; and

using the analysis performed by the first analyzer circuit for the analysis performed by the second analyzer circuit, wherein the first and second analyzer circuits are configured for performing respective different levels of analysis comprise lower and higher level analyzer circuits, respectively, wherein the lower level analyzer circuit is configured to perform an explicit level of analysis, while the higher level analyzer circuit is configured to perform an implicit level of analysis, wherein the implicit level of analysis comprises recognizing the presence of a protocol, which is not readily identifiable in a definite manner by a protocol header, which precedes this protocol in a protocol stack, whereas the explicit level of analysis comprises recognizing the presence of a protocol, which is readily identifiable in a definite manner by a protocol header, which precedes this protocol in the protocol stack.

7. The method of claim 6 , wherein setting successive levels of analysis comprises defining the first level of analysis performed by the first level analyzer circuit by classifying the packets by hash coding their source address or signature and forwarding the classified packets to the second level analyzer circuit in the second level of analysis.

8. The method of claim 6 , wherein the method further comprises providing a semantic recognition of the traffic flow based on the analysis performed by the first and second levels of analysis.

9. The method of claim 7 , further comprising:

analyzing incoming packets arriving at an incoming end of the communications link, by at least one of the elementary processors;

copying the packets into a memory; and

processing the packets stored in the memory using a processor for analyzing the packets and writing the state information into a storage module; and

performing the analysis for all the incoming packets in parallel and independently from the copying, duplicating, and processing steps.

10. The method of claim 9 , wherein the network microprocessor comprises a parallel processing architecture.

11. The method of claims 9 , wherein the method further comprises duplicating the packets to an output link of the communication link.